build(deps): bump the patches group in /docs with 2 updates (#4265)

Co-authored-by: LCB <me@lbellows.com>
Co-authored-by: Geoff Bourne <itzgeoff@gmail.com>

Dockerfile

@@ -17,7 +17,7 @@ ARG KNOCKD_REPO_ORG=Metalcape/knock
 RUN --mount=target=/build,source=build \
     TARGET=${TARGETARCH}${TARGETVARIANT} \
     /build/run.sh install-packages
-COPY --from=tianon/gosu /gosu /usr/local/bin/
+COPY --from=tianon/gosu:1.19 /gosu /usr/local/bin/
 
 RUN --mount=target=/build,source=build \
     /build/run.sh setup-user
@@ -51,13 +51,13 @@ RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-server-runner
-ARG MC_SERVER_RUNNER_VERSION=1.15.1
+ARG MC_SERVER_RUNNER_VERSION=1.15.2
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
   --var version=${MC_SERVER_RUNNER_VERSION} --var app=mc-server-runner --file {{.app}} \
   --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 # renovate: datasource=github-releases packageName=itzg/mc-image-helper versioning=loose
-ARG MC_HELPER_VERSION=1.66.1
+ARG MC_HELPER_VERSION=1.67.1
 ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1

docs/mods-and-plugins/curseforge-files.md

@@ -6,7 +6,7 @@ A specific file can be omitted from each reference to allow for auto-selecting t
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key).
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. A CurseForge API key can be allocated and set with `CF_API_KEY` (or `CF_API_KEY_FILE`) [as described here](../types-and-platforms/mod-platforms/auto-curseforge.md#api-key). The `java8` image (and other pre-Java 17 tags) does not include a baked-in key; set `CF_API_KEY` yourself.
 
 ## Project-file references
 

docs/requirements.txt

@@ -1,8 +1,8 @@
-click==8.4.2
+click==8.5.0
 colorama==0.4.6
-deepmerge==2.1.0
+deepmerge==3.0
 ghp-import==2.1.0
-griffe==2.1.0
+griffe==2.2.0
 Jinja2==3.1.6
 Markdown==3.10.3
 MarkupSafe==3.0.3
@@ -11,15 +11,15 @@ mkdocs==1.6.1
 mkdocs-autorefs==1.4.4
 mkdocs-get-deps==0.2.2
 mkdocstrings==1.0.6
-mkdocstrings-python==2.0.5
+mkdocstrings-python==2.0.7
 packaging==26.3
 pathspec==1.1.1
-platformdirs==4.11.3
-Pygments==2.20.0
-pymdown-extensions==11.0.1
+platformdirs==4.11.5
+Pygments==2.21.0
+pymdown-extensions==11.0.2
 python-dateutil==2.9.0.post0
 PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
 watchdog==6.0.0
-zensical==0.0.54
+zensical==0.0.57

docs/types-and-platforms/mod-platforms/auto-curseforge.md

@@ -6,7 +6,9 @@ To manage a CurseForge modpack automatically with upgrade support, pinned or lat
 
 !!! info "CurseForge API key usage"
 
-    A CurseForge API key is _now_ included by this image; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+    A CurseForge API key is _now_ included by this image on Java 17 and newer; however, you can always supply your own instead. Go to their [developer console](https://console.curseforge.com/), generate an API key, and set the environment variable `CF_API_KEY`.
+
+    The `java8` image (and other pre-Java 17 tags) does **not** include that key. Set `CF_API_KEY` yourself, or install the pack on a Java 17+ image first. See [Java 8](../../versions/java.md#java-8).
 
     When entering your API Key in a docker compose file you will need to escape any `$` character with a second `$`. Refer to [this compose file reference section](https://docs.docker.com/compose/compose-file/compose-file-v3/#variable-substitution) for more information.
 

docs/types-and-platforms/mod-platforms/modrinth-modpacks.md

@@ -50,7 +50,7 @@ Some mods, such as [MCInstance Loader](https://modrinth.com/mod/mcinstance-loade
 
 ## Excluding files
 
-To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of partial file names to exclude. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To exclude client mods that are incorrectly declared by the modpack as server-compatible, set `MODRINTH_EXCLUDE_FILES` to a comma or newline delimited list of file name matchers. Each entry is a case-insensitive substring of the file path, or a regular expression if surrounded with `/` (same convention as [`CF_FILENAME_MATCHER`](auto-curseforge.md#pinning-modpack-and-mod-loader-versions)). You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 
@@ -64,7 +64,7 @@ To exclude client mods that are incorrectly declared by the modpack as server-co
 
 ## Force-include files
 
-To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of partial file names. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
+To force include client mods, set `MODRINTH_FORCE_INCLUDE_FILES` to a comma or newline delimited list of file name matchers using the same substring or `/regex/` rules as `MODRINTH_EXCLUDE_FILES`. You may need to set `MODRINTH_FORCE_SYNCHRONIZE` to "true" while iterating on a compatible set of mods to use.
 
 !!! example
 

docs/versions/java.md

@@ -111,7 +111,11 @@ Caused by: org.spongepowered.asm.mixin.throwables.ClassMetadataNotFoundException
 
 #### Java 8
 
-For Forge versions less than 1.18, you _must_ use the `java8-multiarch` (or other java8) image tag.
+For Forge versions less than 1.18, you _must_ use the `java8` (or other java8) image tag.
+
+!!! warning "Java 8 is in maintenance mode"
+
+    The `java8` / `java8-jdk` tags, and other pre-Java 17 tags (`java11`, `java16`), pin an older `mc-image-helper` that predates the baked-in CurseForge API key. `AUTO_CURSEFORGE` and `CURSEFORGE_FILES` on those images require you to set `CF_API_KEY` yourself. Java 17+ images include a key and do not need this.
 
 In general, if you see the following line in a server startup failure, then it means you need to be using Java 8 instead of the latest image Java version:
 

examples/podman-quadlets/README.md

@@ -37,6 +37,8 @@ ln -s ${XDG_CONFIG_HOME}/containers/systemd/mc@.service ${XDG_CONFIG_HOME}/conta
 
 If running rootless, be sure to enable lingering with `sudo loginctl enable-linger $USER`.
 
+`GroupAdd=0` when rootless the equivalent of the user's group id, not the hosts root.
+
 Also note that source IPs are currently lost due to how rootless podman handles custom networks.
 This should be fixed in a future podman release.[^3]
 

examples/podman-quadlets/mc-router.container

@@ -6,6 +6,7 @@ Image=docker.io/itzg/mc-router
 ContainerName=%N
 AutoUpdate=registry
 UserNS=host
+GroupAdd=0
 Volume=%t/podman/podman.sock:/var/run/docker.sock:ro
 Network=minecraft.network
 PublishPort=25565:25565

files/cf-exclude-include.json

@@ -187,6 +187,9 @@
     "create-arcane-engineering": {
       "forceIncludes": ["just-enough-resources-jer"]
     },
+    "fantasy-minecraft-fabric": {
+      "forceIncludes": ["simply-tooltips", "icon-leading-tooltip"]
+    },
     "ftb-stoneblock-4": {
       "forceIncludes": [
         "particular-reforged",

files/modrinth-exclude-include.json

@@ -49,7 +49,7 @@
     "fast-ip-ping",
     "fastquit",
     "feytweaks",
-    "figura",
+    "/(^|/)figura-/",
     "ForgeConfigScreens",
     "GeckoLibIrisCompat",
     "gpumemleakfix",
@@ -110,9 +110,6 @@
     "cobbleverse": {
       "excludes": [
         "cloth-config"
-      ],
-      "forceIncludes": [
-        "configurable"
       ]
     }
   }

scripts/start-deployBukkitSpigot

@@ -43,7 +43,7 @@ function buildSpigotFromSource {
   fi
 
   logn ''
-  curl -sSL -o ${tempDir}/BuildTools.jar https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
+  curl -fsSL -o "${tempDir}/BuildTools.jar" https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
     java $jvmOpts -jar ${tempDir}/BuildTools.jar --rev "$VERSION" 2>&1 |tee ${spigotBuildLog}| while read l; do echo -n .; done; log "done"
 
   case ${TYPE^^} in

scripts/start-deployCF

@@ -127,7 +127,7 @@ if ! isTrue "${USE_MODPACK_START_SCRIPT:-true}"; then
     echo "${FTB_SERVER_MOD}" > $installMarker
   fi
 
-  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  SERVER=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ -z "${SERVER}" || ! -f "${SERVER}" ]]; then
     logError "Unable to locate installed forge server jar"
     isDebugging && find "${FTB_BASE_DIR}" -name "forge*.jar"
@@ -200,7 +200,7 @@ if [[ ! $startScript ]]; then
   # no, then look for a forge jar to run
 
   # Allow up to 2 levels since some modpacks have a top-level directory named for the modpack
-  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "/libraries/*" -o -path "/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
+  forgeJar=$(find "${FTB_BASE_DIR}" -maxdepth 2 -type f \( -path "*/libraries/*" -o -path "*/mods/*" \) -prune -o -name "forge*.jar" -not -name "forge*installer.jar" -print)
   if [[ "$forgeJar" ]]; then
     FTB_BASE_DIR=$(dirname "${forgeJar}")
     export FTB_BASE_DIR

scripts/start-deployCustom

@@ -16,8 +16,8 @@ if isURL "${CUSTOM_SERVER}"; then
     log "Using previously downloaded jar at ${SERVER}"
   else
    log "Downloading custom server jar from ${CUSTOM_SERVER} ..."
-   if ! curl -sSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
-      log "Failed to download from ${CUSTOM_SERVER}"
+   if ! curl -fsSL -o "${SERVER}" "${CUSTOM_SERVER}"; then
+      logError "Failed to download from ${CUSTOM_SERVER}"
       exit 2
     fi
   fi

scripts/start-deployFTBA

@@ -9,7 +9,7 @@ ftbInstallMarker=".ftb-installed"
 # shellcheck source=start-utils
 . "$(dirname "$0")/start-utils"
 isDebugging && set -x
-set -e
+set -e -o pipefail
 
 #
 #{
@@ -93,7 +93,10 @@ if isTrue "$FTB_FORCE_REINSTALL" ||
 
   log "Installing modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
   log "This could take a while..."
-  ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log
+  if ! ${ftbInstaller} -pack "${FTB_MODPACK_ID}" -version "${FTB_MODPACK_VERSION_ID}" -auto -force -no-java | tee ftb-installer.log; then
+    logError "FTB installer failed for modpack ID ${FTB_MODPACK_ID}, version ID ${FTB_MODPACK_VERSION_ID}"
+    exit 1
+  fi
   rm -f forge*installer.jar
 
   echo "${FTB_MODPACK_ID}=${FTB_MODPACK_VERSION_ID}" > ${ftbInstallMarker}
@@ -140,9 +143,9 @@ if [[ $SERVER = run.sh ]]; then
   elif grep -q forge "$SERVER"; then
     export FAMILY=FORGE
     export TYPE=FORGE
-  elif grep -q fabric run.s; then
-      export FAMILY=FABRIC
-      export TYPE=FABRIC
+  elif grep -q fabric "$SERVER"; then
+    export FAMILY=FABRIC
+    export TYPE=FABRIC
   else
     logError "Unrecognized loader type in $SERVER"
     cat "$SERVER"

scripts/start-deployForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${FORGE_VERSION:=${FORGEVERSION:-RECOMMENDED}}"
-: "${FORGE_FORCE_REINSTALL:=false}}"
+: "${FORGE_FORCE_REINSTALL:=false}"
 
 # shellcheck source=start-utils
 . "${SCRIPTS:-$(dirname "$0")}/start-utils"

scripts/start-deployNeoForge

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 : "${NEOFORGE_VERSION:=latest}"
-: "${NEOFORGE_FORCE_REINSTALL:=false}}"
+: "${NEOFORGE_FORCE_REINSTALL:=false}"
 : "${NEOFORGE_INSTALLER:=}"
 
 # shellcheck source=start-utils

scripts/start-deploySpongeVanilla

@@ -22,18 +22,28 @@ case "$SPONGEBRANCH" in
 esac
 
 # If not SPONGEVERSION selected, detect last version on selected branch
-if [ -z $SPONGEVERSION ]; then
+if [ -z "$SPONGEVERSION" ]; then
   log "Choosing Version for Sponge"
-  SPONGEVERSION=$(curl -fsSL https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes.$SPONGEBRANCH.latest.version')
+  if ! SPONGEVERSION=$(curl -fsSL "https://dl-api.spongepowered.org/v1/org.spongepowered/$TYPE" | jq -r --arg SPONGEBRANCH "$SPONGEBRANCH" '.buildTypes[$SPONGEBRANCH].latest.version'); then
+    logError "Failed to resolve latest SpongeVanilla version from the Sponge downloads API"
+    exit 1
+  fi
+  if [[ -z $SPONGEVERSION || $SPONGEVERSION == null ]]; then
+    logError "Sponge downloads API did not return a version for branch $SPONGEBRANCH"
+    exit 1
+  fi
 fi
 
 VERSION="$SPONGEVERSION"
 export VERSION
 export SERVER="spongevanilla-$SPONGEVERSION.jar"
 
-if [ ! -e "$SERVER" ] || [ -n "$FORCE_REDOWNLOAD" ]; then
+if [ ! -e "$SERVER" ] || isTrue "${FORCE_REDOWNLOAD}"; then
   log "Downloading $SERVER ..."
-  curl -sSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"
+  if ! curl -fsSL -o "$SERVER" "https://repo.spongepowered.org/maven/org/spongepowered/$TYPE/$SPONGEVERSION/$SERVER"; then
+    logError "Failed to download $SERVER"
+    exit 1
+  fi
 fi
 
 export FAMILY=SPONGE

scripts/start-finalExec

@@ -491,7 +491,7 @@ if [[ ${STOP_SERVER_ANNOUNCE_DELAY} ]]; then
   mcServerRunnerArgs+=(--stop-server-announce-delay "${STOP_SERVER_ANNOUNCE_DELAY}s")
 fi
 if [[ ${STOP_SERVER_DELAY_COMMAND} ]]; then
-  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}s")
+  mcServerRunnerArgs+=(--stop-server-delay-command "${STOP_SERVER_DELAY_COMMAND}")
 fi
 if isTrue "${ENABLE_SSH}"; then
   mcServerRunnerArgs+=(--remote-console)
@@ -500,7 +500,10 @@ fi
 if [[ ${TYPE} == "CURSEFORGE" && "${SERVER}" ]]; then
   copyFilesForCurseForge
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Starting CurseForge server in ${FTB_DIR}..."
   if isTrue "${DEBUG_EXEC}"; then
     set -x
@@ -513,11 +516,15 @@ elif [[ ${TYPE} == "CURSEFORGE" ]]; then
 
 if isPercentage "$INIT_MEMORY" || isPercentage "$MAX_MEMORY"; then
 # Convert to bytes
-NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY")
-NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY")
-# Convert to MB
-((NORM_INIT_MEM*=1048576))
-((NORM_MAX_MEM*=1048576))
+if ! NORM_INIT_MEM=$(normalizeMemSize "$INIT_MEMORY"); then
+  exit 1
+fi
+if ! NORM_MAX_MEM=$(normalizeMemSize "$MAX_MEMORY"); then
+  exit 1
+fi
+# Convert bytes to MB
+((NORM_INIT_MEM/=1048576))
+((NORM_MAX_MEM/=1048576))
 
   cat > "${FTB_DIR}/settings-local.sh" <<EOF
 export MIN_RAM="${NORM_INIT_MEM}M"
@@ -541,7 +548,10 @@ fi
     fi
   fi
 
-  cd "${FTB_DIR}" || (logError "Can't go into ${FTB_DIR}"; exit 1)
+  if ! cd "${FTB_DIR}"; then
+    logError "Can't go into ${FTB_DIR}"
+    exit 1
+  fi
   log "Running FTB ${FTB_SERVER_START} in ${FTB_DIR} ..."
 
   finalArgs="${FTB_SERVER_START}"

scripts/start-setupModpack

@@ -77,11 +77,13 @@ if [[ "$MODPACK" ]]; then
     mkdir -p "$PLUGINS_OUT_DIR"
     if ! unzip -o -d "$PLUGINS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   else
     mkdir -p "$MODS_OUT_DIR"
     if ! unzip -o -d "$MODS_OUT_DIR" /tmp/modpack.zip; then
       logError "Failed to unzip the modpack from ${MODPACK}"
+      exit 2
     fi
   fi
   rm -f /tmp/modpack.zip

scripts/start-utils

@@ -368,9 +368,22 @@ function logRcon() {
 }
 
 function normalizeMemSize() {
+  # Convert a JVM-style size (k/m/g) or a percentage of the container memory
+  # limit into bytes. Bash arithmetic is integer-only, so percentages cannot
+  # use a 0.01 scale factor.
+  local input=${1?}
+  local val=${input:0:-1}
   local scale=1
-  local mem=1
-  case ${1,,} in
+  local mem
+
+  val=${val// /}
+  val=${val%%.*}
+  if ! [[ $val =~ ^[0-9]+$ ]]; then
+    logError "Unable to parse memory size '$input'"
+    return 1
+  fi
+
+  case ${input,,} in
   *k)
     scale=1024
     ;;
@@ -381,19 +394,25 @@ function normalizeMemSize() {
     scale=1073741824
     ;;
   *%)
-    # Get system memory
-    if [ -f "/sys/fs/cgroup/memory/memory.limit_in_bytes" ]; then
-    mem=$( cat /sys/fs/cgroup/memory/memory.limit_in_bytes )
-    elif [ -f "/sys/fs/cgroup/memory.max" ]; then
-    mem=$( cat /sys/fs/cgroup/memory.max )
+    if [ -f /sys/fs/cgroup/memory/memory.limit_in_bytes ]; then
+      mem=$(cat /sys/fs/cgroup/memory/memory.limit_in_bytes)
+    elif [ -f /sys/fs/cgroup/memory.max ]; then
+      mem=$(cat /sys/fs/cgroup/memory.max)
     fi
-    # Scale is used to transform percentages into decimals (eg. 60 -> 0.6)
-    scale=0.01
+    # cgroup v2 unlimited is "max"; cgroup v1 uses a large sentinel (~2^63).
+    if [[ $mem == max || ! $mem =~ ^[0-9]+$ ]] || (( mem > 1 << 62 )); then
+      mem=$(awk '/MemTotal:/ { print $2 * 1024 }' /proc/meminfo)
+    fi
+    if ! [[ $mem =~ ^[0-9]+$ ]]; then
+      logError "Unable to determine memory limit for percentage value '$input'"
+      return 1
+    fi
+    echo $((val * mem / 100))
+    return 0
     ;;
   esac
 
-  val=${1:0:-1}
-  echo $((val * scale * mem))
+  echo $((val * scale))
 }
 
 function compare_version() {
@@ -579,12 +598,24 @@ function extract() {
 
   case "${type}" in
   application/zip)
+    if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     unzip -o -q -d "${destDir}" "${src}" "$@"
     ;;
   application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
+    if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" -xf "${src}" "$@"
     ;;
   application/zstd | application/x-zstd)
+    if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
     ;;
   *)